惠生公司F培训 day学习指导书.pptVIP

Client SSL Plus Server SSL Encrypted Encrypted Decrypted inside BIG-IP LTM SSL Acceleration Chip or card Encryption / Decryption done with hardware – faster 1600 – 500 to 5000 TPS 3600 – 500 to 10000 TPS 3900 – 500 to 15000 TPS 6900 – 500 to 25000 TPS 8900 – 500 to 58000 TPS Generate Certificate Create SSL Profile Point VS to Profile SSL Termination Labs Client SSL : Generate Certificate Custom Client SSL profile vs_ssl 10.10.X.102:443 using Client SSL profile Test: Connect :443 to :80 web? Server SSL (Optional): Custom Server SSL profile vs_ssl using both Client and Server SSL profiles Test again: Internet 10.10.X.102:443 80 * * Let’s look at insert mode cookie persistence in more detail: Client connects the first time: the web browser has yet to receive a cookie for this site. BIG-IP detects that no cookie is present, and forwards the connection to the most appropriate available node. The node issues its http reply to the client. BIG-IP inserts a cookie with the appropriate expiration value and specific node information. Client connects back a second time. This time the web browser inserts the cookie in its http request. BIG-IP reads the cookie, and forwards the connection to the specified server The node issues its http reply to the client. BIG-IP updates the expiration value in the cookie. The advantage of insert mode cookie persistence is that the web servers remain untouched. The drawback is that the BIG-IP controller has an increased workload. Note that the BIG-IP controller is unable to forward the incoming connection to the appropriate node until it receives the cookie. As such, it needs to perform the initial TCP handshake with the connecting client. Once the BIG-IP controller has received and read the cookie, it can determine which node to forward the connection on to. Again, the controller must perform the initial TCP handshake with the node. As such, the BIG-IP controller behaves very much like a proxy server. Let’s look at rewrite mod